Not enforced no, but this works a lot of the time though (include info@ as well). In whois data you can also always find an email contact for abuse notifications

(To be fair, I was a bit annoyed by a recent AI bro spamming about fifteen such prefixes on my domain with a false positive vulnerability report. The PoC did not work and the field they were injecting was already correctly escaped. But it is an effective contact method if you're facing a bulk problem like this I suppose. Maybe try just one prefix at a time until an email is accepted)

Surely those addresses are compromised in most cases where the server itself is compromised?